mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-07 09:09:23 +00:00
Code Issues Releases Wiki Activity
linux-stable/arch/riscv/kvm
History
David Matlack 2ed90cb093 KVM: RISC-V: Retry fault if vma_lookup() results become invalid 
Read mmu_invalidate_seq before dropping the mmap_lock so that KVM can
detect if the results of vma_lookup() (e.g. vma_shift) become stale
before it acquires kvm->mmu_lock. This fixes a theoretical bug where a
VMA could be changed by userspace after vma_lookup() and before KVM
reads the mmu_invalidate_seq, causing KVM to install page table entries
based on a (possibly) no-longer-valid vma_shift.

Re-order the MMU cache top-up to earlier in user_mem_abort() so that it
is not done after KVM has read mmu_invalidate_seq (i.e. so as to avoid
inducing spurious fault retries).

It's unlikely that any sane userspace currently modifies VMAs in such a
way as to trigger this race. And even with directed testing I was unable
to reproduce it. But a sufficiently motivated host userspace might be
able to exploit this race.

Note KVM/ARM had the same bug and was fixed in a separate, near
identical patch (see Link).

Link: https://lore.kernel.org/kvm/20230313235454.2964067-1-dmatlack@google.com/
Fixes: 9955371cc0 ("RISC-V: KVM: Implement MMU notifiers")
Cc: stable@vger.kernel.org
Signed-off-by: David Matlack <dmatlack@google.com>
Tested-by: Anup Patel <anup@brainfault.org>
Signed-off-by: Anup Patel <anup@brainfault.org>
2023-04-21 17:38:40 +05:30
..
Kconfig KVM: Opt out of generic hardware enabling on s390 and PPC 2022-12-29 15:48:37 -05:00
main.c KVM/riscv changes for 6.3 2023-02-15 12:33:28 -05:00
Makefile RISC-V: KVM: Add SBI PMU extension support 2023-02-07 20:35:53 +05:30
mmu.c KVM: RISC-V: Retry fault if vma_lookup() results become invalid 2023-04-21 17:38:40 +05:30
tlb.c ARM: 2023-02-25 11:30:21 -08:00
vcpu.c RISC-V: KVM: Add skeleton support for perf 2023-02-07 20:35:51 +05:30
vcpu_exit.c RISC-V: KVM: Redirect illegal instruction traps to guest 2023-02-07 20:35:28 +05:30
vcpu_fp.c RISC-V: KVM: Improve ISA extension by using a bitmap 2022-07-29 17:14:11 +05:30
vcpu_insn.c RISC-V: KVM: Implement trap & emulate for hpmcounters 2023-02-07 20:36:01 +05:30
vcpu_pmu.c RISC-V: KVM: Support firmware events 2023-02-07 20:36:06 +05:30
vcpu_sbi.c RISC-V: KVM: Add SBI PMU extension support 2023-02-07 20:35:53 +05:30
vcpu_sbi_base.c RISC-V: KVM: Modify SBI extension handler to return SBI error code 2023-02-07 20:35:45 +05:30
vcpu_sbi_hsm.c RISC-V: KVM: Modify SBI extension handler to return SBI error code 2023-02-07 20:35:45 +05:30
vcpu_sbi_pmu.c RISC-V: KVM: Add SBI PMU extension support 2023-02-07 20:35:53 +05:30
vcpu_sbi_replace.c RISC-V: KVM: Increment firmware pmu events 2023-02-07 20:36:08 +05:30
vcpu_sbi_v01.c RISC-V: KVM: Modify SBI extension handler to return SBI error code 2023-02-07 20:35:45 +05:30
vcpu_switch.S RISC-V: KVM: Refine __kvm_riscv_switch_to() implementation 2022-03-11 19:02:22 +05:30
vcpu_timer.c riscv/kvm: Fix VM hang in case of timer delta being zero. 2023-03-17 13:32:54 +05:30
vm.c RISC-V: KVM: Make kvm_riscv_guest_timer_init a void function 2022-07-29 17:14:26 +05:30
vmid.c KVM: RISC-V: Tag init functions and data with __init, __ro_after_init 2022-12-29 15:41:18 -05:00